AI agent identity and lateral movement: why architecture fails

At a glance

What this is: This article argues that preventing lateral movement now depends on architecture, not isolated controls, as AI agents add a new identity layer to environments already strained by credential abuse.

Why it matters: It matters because IAM, PAM, and NHI programmes now have to separate human, service, and AI agent identity while constraining east-west reach, or compromise will keep spreading laterally.

By the numbers:

• Credential abuse is now the single most common initial access vector, used in 22 percent of breaches.
• Breaches involving compromised credentials took an average of 246 days to identify and contain in 2025.

Context

Lateral movement is the phase of an intrusion where an attacker moves from one compromised asset or identity to another after getting a foothold. In this article, the governance gap is that many Zero Trust and identity programmes still treat lateral movement as a detection problem instead of an architectural constraint problem, even as AI agents add another identity class to control.

The practical issue is not just initial access. Once credentials are abused, the environment’s own east-west paths, administrative accounts, and service identities can become the route to broader compromise unless segmentation, identity separation, and policy enforcement are built around how the environment actually operates.

AI agents change the design problem because they can exist beside human users and service accounts on the same endpoints, making identity boundaries harder to reason about with legacy assumptions. The article frames this as a control-plane issue, not a point-product issue.

Key questions

Q: What breaks when an attacker can move laterally with valid credentials?

A: The failure is that internal authentication no longer proves legitimacy. Once a valid identity can reach multiple hosts, the attacker can impersonate normal administration, reuse trust relationships, and blend into expected traffic while expanding access. That is why lateral movement turns identity governance into a containment problem, not just a login problem.

Q: Why do AI agents make lateral movement harder to contain?

A: AI agents add more runtime identities to the same endpoint and can act faster than human review cycles. That creates more chances for shared trust, overbroad permissions, and unclear accountability. The risk is not simply automation, but the multiplication of executors that can reuse access and extend internal reach before teams notice.

Q: How do security teams know if lateral movement defences are actually working?

A: Teams should test whether one compromised identity can reach adjacent systems, SaaS apps, or production zones that it should not access. If the answer is yes, segmentation or identity policy is too permissive. Effective controls show up as blocked traversal attempts, rapid isolation, and limited blast radius during simulations.

Q: What is the difference between microsegmentation and a proxy boundary for legacy assets?

A: Microsegmentation limits which identities can reach an asset, while a proxy or policy enforcement boundary controls and mediates the traffic itself. They solve different parts of the same problem. Together, they reduce direct reachability and make it harder for compromised identities to talk laterally to protected devices.

Technical breakdown

Why lateral movement is an architectural problem

Lateral movement succeeds when the network and identity model assume that an authenticated internal actor is trustworthy enough to move freely. Zero Trust, properly understood, removes that assumption and requires every east-west request to be evaluated on its own merit. That means the control objective is not only to detect movement after compromise, but to reduce the reachable surface that any compromised identity can traverse. In environments with service accounts, admin tools, and AI agents, the architectural question becomes how identities are separated from one another before an incident occurs.

Practical implication: design segmentation and identity policy together so a compromised identity cannot traverse the environment by default.

How AI agent identity complicates east-west control

AI agents are not just another automation layer when they can act alongside humans and services at runtime. The article’s point is that a machine with operational reach on the endpoint changes the trust model, because you can no longer assume one user equals one operative identity. If a human, a service account, and several AI agents share execution context, then east-west policy must distinguish which actor is allowed to initiate action, call tools, or reach adjacent systems. That is an identity separation problem, not only a network one.

Practical implication: inventory AI agents as distinct identities and map their reach separately from users and service accounts.

Why microsegmentation and proxy enforcement work together

Microsegmentation narrows which identities can reach a device or workload, while a proxy or policy enforcement point mediates the actual traffic. The article uses legacy devices as the clearest example: if a system cannot be patched or replatformed, the safer approach is to make it reachable only through a controlled boundary that limits who can talk to it. This is especially relevant where the asset must remain on the network but should not be directly reachable from other assets. The mechanism is less about hiding the device and more about enclosing it in identity-aware reachability rules.

Practical implication: combine segmentation with an enforcement point so legacy and high-risk assets are not directly addressable.

Threat narrative

Attacker objective: The attacker’s objective is to turn one compromised identity into broader internal reach and sustained access across multiple systems.

1. Entry occurs when credential abuse provides the initial foothold, which the article identifies as the most common access vector in breaches.
2. Escalation follows when the attacker uses internal trust, over-broad administrative paths, or shared access patterns to move from the first system to adjacent ones.
3. Impact emerges when weak east-west containment lets the intruder spread beyond the original compromise and extend the breach across the environment.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Lateral movement prevention is an architectural objective, not a tooling outcome: The control failure here is not the absence of a single product feature. It is the assumption that detection and response can compensate for an environment that still allows compromised identities to move freely. When identity, segmentation, and enforcement are designed separately, the attacker inherits the joins between them. Practitioners should treat containment as a property of architecture, not a post-breach hope.

AI agents expose a new identity separation problem: The familiar model of one human user, one machine, and a manageable number of service accounts no longer holds when AI agents operate on the same endpoint and can initiate their own actions. That does not mean every agent is autonomous; it means the identity fabric must distinguish who or what is acting at runtime. The implication is that agent identity cannot be folded into generic endpoint policy without losing control fidelity.

Identity blast radius is the right concept for modern Zero Trust programmes: Once credentials are abused, the real question is how much of the environment remains reachable from that identity. That is the control variable practitioners should optimise, because lateral movement is the mechanism that converts local compromise into enterprise-wide exposure. The programme goal becomes smaller reachable sets, not merely faster detection. Security teams should measure blast radius, not just alert volume.

Incremental architecture beats wholesale replatforming: The article’s strongest governance point is that Zero Trust succeeds by sequencing, not by declaring a finished state. Legacy devices, shared infrastructures, and AI-heavy endpoints all require partial containment steps that create the next control plane. Practitioners should stop treating lateral movement control as a one-time redesign and instead build an architecture that can absorb new identity classes without reopening trust paths.

Zero Trust messaging needs a trust-target reset: The problem is not distrust of users, developers, or operators. The problem is trust in administrative tools, east-west pathways, and machine reachability that were never meant to be implicitly safe. That framing matters because it changes adoption from organisational resistance to operational discipline. Security leaders should make the network less trusting of itself before asking users to change behaviour.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: Zero Trust for AI Agents

What this signals

Identity blast radius is now a programme metric: Security leaders need a way to describe how far a compromised identity can travel before controls stop it. That is a stronger operational measure than simply counting alerts, because lateral movement is what converts a local compromise into enterprise exposure.

The same containment logic now has to cover human users, service accounts, and AI agents without assuming they behave like the same actor type. If an agent can share execution space with a person but still initiate its own action path, existing access models will miss the boundary that matters.

Teams should expect Zero Trust to become more identity-specific, not less. The control question is shifting from whether the network is trusted to which identities are allowed to reach which assets, and under what mediated conditions.

For practitioners

• Map identity blast radius per actor Define the maximum reachable scope for each human, service account, and AI agent identity, then compare it to actual business need. Remove adjacency that is not required for task completion and document the exceptions.
• Enforce east-west segmentation by identity Apply policy so internal systems are not broadly addressable just because they are on the same network. Use identity-aware controls to limit which workloads, users, or agents can initiate connections.
• Separate AI agents from human and service identities Treat AI agents as distinct runtime identities when they can initiate actions or reach tools independently. Assign explicit scope and prevent them from inheriting broader access through shared endpoint context.
• Enclave legacy and unpatchable assets Place unpatchable systems behind a proxy or policy enforcement boundary so they are not directly reachable from the rest of the environment. Use reachability rules that reflect asset identity, not simple network location.

Key takeaways

• Lateral movement remains the step where a local compromise becomes a broader incident, so containment has to be architectural rather than reactive.
• AI agents complicate identity governance because they add runtime actors that can share infrastructure with humans and services while still needing separate control boundaries.
• The strongest control pattern in this article is identity-aware segmentation combined with mediation for assets that cannot be replatformed or patched quickly.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• East-west traffic: East-west traffic is communication that moves between systems inside an environment rather than entering or leaving it. In microsegmentation programmes, it is the traffic most likely to expose hidden trust assumptions and is therefore the main target for workload-level policy.
• Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.